Nothing checked this workspace's ~68 direct dependencies before this: no advisory scanning, no license policy, no duplicate-version check. deny.toml scopes the graph to the two targets this project actually builds for (x86_64-unknown-linux-gnu and didbot-site-anim's wasm32-unknown-unknown), accepts permissive licenses plus MPL-2.0 (weak, file-level copyleft) but no GPL/AGPL for a server binary holding operator credentials, and names every advisory ignore and duplicate-version skip with the reason it's tolerated rather than fixed. `cargo deny check` passes clean against the current Cargo.lock. Wired into prek's pre-commit hooks, gated on Cargo.toml/ Cargo.lock/deny.toml changes so it doesn't run on every commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: Idf6f7afc5a52eb73aaafffa485c032cbc41bbe16